NetIQ Identity Manager 4.9 Release Notes
NetIQ Identity Manager 4.9 provides new features, enhancements, improves usability, and resolves several previous issues. The updates in this release are cumulative. They include software fixes and enhancements in the current version, as well as all previously released fixes from the service packs, patches, and hotfixes. Many of these improvements were made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure that our products meet all your needs. You can post feedback in the Identity Manager Community Forums on NetIQ Communities, our online community that also includes product information, blogs, and links to helpful resources.
For information about what’s new in previous releases, see the “Previous Releases” section on the Identity Manager Documentation Website.
For more information about this release and for the latest release notes, see the Documentation page. To download this product, see the Software Licenses and Downloads portal.
10.0 Known Issues
NetIQ strives to ensure our products provide quality solutions for your enterprise software needs. The following issues are currently being researched. If you need further assistance with any issue, please contact Technical Support. For the list of known issues in Designer, see the NetIQ Identity Manager Designer 4.9 Release Notes.
-
An Error Occurs While Logging in to Identity Manager When Using Two-Factor Authentication
-
The dirxml_remote and RLConsole Properties Displays Outdated Product Version
-
Some Reports Do Not Fetch Any Data While Using MS SQL Database
-
Identity Manager Does Not Reflect Changes Made to the Use SMTP TLS Option in Identity Console
-
Tomcat Does Not Start on RHEL 8.x and 9.x After Upgrading Identity Manager to 4.9
-
Organization Chart Buttons for a Level 2 or Higher Relationship Hierarchy Is Missing
-
Remote Loader Reports Invalid Driver Object Password After Upgrade
-
Observing Error: StatusLogger Reconfiguration Failed in Catalina Log File
10.1 Windows Installer Displays an Exception
Issue: Starting Tomcat after installing Identity Manager 4.9 components displays the following exception: SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to start component [Connector["ajp-nio-<IP_address>-8010"]]
This issue occurs during a fresh installation and after upgrading to Identity Manager 4.9. [Issue: OCTCR56A607041]
Workaround: It does not cause any functionality loss. However, if you want to resolve the issue, delete the following line in the server.xml file:
<Connector port="8010" protocol="AJP/1.3" redirectPort="8543"/>
The server.xml file is located at C:\NetIQ\idm\apps\tomcat\conf
10.2 An Error Occurs While Logging in to Identity Manager When Using Two-Factor Authentication
Issue: Users might encounter login failures if NetIQ One SSO Provider (OSP) on the Identity Manager server is configured with NetIQ Advanced Authentication for two-factor authentication. The OSP log file displays the following error: Unexpected error while searching: internal.atlaslite.jcce.exception.CoreInitializationException: No administrator password is configured.
[Issue: OCTCR56A603388]
Workaround: No workaround is available.
10.3 The dirxml_remote and RLConsole Properties Displays Outdated Product Version
Issue: When you install or upgrade Remote Loader through the Identity_Manager_4.9_RL_Windows.iso or Identity_Manager_4.9_RL_Linux.iso, you might notice that the does not change in the window. It still shows . The same issue is seen in properties. [Issue: OCTCR56A608072]
Workaround: It does not impact the Remote Loader functionality. You can check the in the same window to confirm whether Remote Loader is installed successfully.
10.4 Installer Generates Empty Database Schema SQL Files
Issue: During the Identity Applications component upgrade, if you choose the write to file option for creating database schema, the installer creates empty databaseschema.sql and wfedatabaseschema.sql files. Because these files are empty, you cannot use them to create database schema after the upgrade is complete. [Issue: OCTCR56A586043]
Workaround: Download the appropriate database jar file on your application server from a third-party website for your Identity Applications database. Install it on a separate system or a server along with Identity Applications.
When the installer prompts you to enter the Identity Applications and Workflow Engine database JDBC jar file path during Identity Applications update, specify the location of the installed database jar file.
10.5 Some Reports Do Not Fetch Any Data While Using MS SQL Database
Issue: If you are using MS SQL as the Identity Reporting database, the , , and reports do not return any data. [Issue:OCTCR56A604404]
Workaround: To fetch the data for the above reports, perform the following steps:
-
Log in to the server where Identity Reporting is installed.
-
Open a database administrator tool such as SQL Server Management Studio.
-
Run the following query:
NOTE:Specify the appropriate Identity Reporting database name in the <identity reporting database name> field.
USE [<identity reporting database name>] GO /****** Object: UserDefinedFunction [IDM_RPT_DATA].[get_formatted_user_dn] Script Date: 5/9/2020 7:03:55 PM ******/ DROP FUNCTION [IDM_RPT_DATA].[get_formatted_user_dn] GO /****** Object: UserDefinedFunction [IDM_RPT_DATA].[get_formatted_user_dn] Script Date: 5/9/2020 7:03:55 PM ******/ SET ANSI_NULLS ON GO SET QUOTED_IDENTIFIER ON GO CREATE FUNCTION [IDM_RPT_DATA].[get_formatted_user_dn] ( -- Add the parameters for the function here @user_path nvarchar(max) , @user_name nvarchar(200) ) RETURNS nvarchar(max) AS BEGIN DECLARE @new_path nvarchar(200), @new_path_2 nvarchar(max), @l_user_path nvarchar(max), @l_old_delimiter nvarchar(1) = '\\', @l_new_delimiter nvarchar(1) = '.', @MyCursor CURSOR, @MyField nvarchar(max); if @user_path is not null BEGIN SET @l_user_path = SUBSTRING(@user_path , 2 , (LEN(@user_path)-1)); SET @MyCursor = CURSOR FOR SELECT value FROM STRING_SPLIT( @l_user_path , @l_old_delimiter ) OPEN @MyCursor FETCH NEXT FROM @MyCursor INTO @MyField WHILE @@FETCH_STATUS = 0 BEGIN if @MyField is not null BEGIN SET @new_path = @l_new_delimiter + @MyField; END if @new_path_2 is not null BEGIN SET @new_path = @new_path + @new_path_2; END SET @new_path_2 = @new_path; FETCH NEXT FROM @MyCursor INTO @MyField END CLOSE @MyCursor DEALLOCATE @MyCursor if @new_path is not null BEGIN SET @new_path = @user_name + @new_path; END else BEGIN SET @new_path = @user_name; END END return LTRIM(RTRIM(@new_path)); END; GO CREATE FUNCTION [IDM_RPT_DATA].[patternReplace] ( @InputString VARCHAR(4000), @Pattern VARCHAR(100), @ReplaceText VARCHAR(4000) ) RETURNS VARCHAR(4000) AS BEGIN DECLARE @Result VARCHAR(4000) SET @Result = '' -- First character in a match DECLARE @First INT -- Next character to start search on DECLARE @Next INT SET @Next = 1 -- Length of the total string -- 8001 if @InputString is NULL DECLARE @Len INT SET @Len = COALESCE(LEN(@InputString), 8001) -- End of a pattern DECLARE @EndPattern INT WHILE (@Next <= @Len) BEGIN SET @First = PATINDEX('%' + @Pattern + '%', SUBSTRING(@InputString, @Next, @Len)) IF COALESCE(@First, 0) = 0 --no match - return BEGIN SET @Result = @Result + CASE --return NULL, just like REPLACE, if inputs are NULL WHEN @InputString IS NULL OR @Pattern IS NULL OR @ReplaceText IS NULL THEN NULL ELSE SUBSTRING(@InputString, @Next, @Len) END BREAK END ELSE BEGIN -- Concatenate characters before the match to the result SET @Result = @Result + SUBSTRING(@InputString, @Next, @First - 1) SET @Next = @Next + @First - 1 SET @EndPattern = 1 -- Find start of end pattern range WHILE PATINDEX(@Pattern, SUBSTRING(@InputString, @Next, @EndPattern)) = 0 SET @EndPattern = @EndPattern + 1 -- Find end of pattern range WHILE PATINDEX(@Pattern, SUBSTRING(@InputString, @Next, @EndPattern)) > 0 AND @Len >= (@Next + @EndPattern - 1) SET @EndPattern = @EndPattern + 1 --Either at the end of the pattern or @Next + @EndPattern = @Len SET @Result = @Result + @ReplaceText SET @Next = @Next + @EndPattern - 1 END END RETURN(@Result) END; GO -
Navigate to the CDN website.
-
Click the report.
-
Download the .rpz and .zip files for the report.
10.6 Error Reported in the Upgrade Log File
Issue: After upgrading Identity Manager to 4.9, users may encounter the following SQL exceptions in the idmupgrade.log file:
Unexpected error running Liquidbase Error: cannot drop view idmrpt_identity_cs_v.
Unexpected error running Liquidbase Error: idmrpt_identity_v already exists.
This issue occurs after you upgrade the reporting component from Identity Manager 4.8.7 to 4.9[OCTCR56A677245].
Workaround: The error does not affect any functionality. You can ignore it.
10.7 Identity Manager Does Not Reflect Changes Made to the Use SMTP TLS Option in Identity Console
Issue: While setting up an email server in Identity Console, if you choose to enable or disable the notSMTPUseTLS attribute for the default notification template in the Tree View, you might notice that the same value does not show up on the Email Based Approval page in Identity Manager. However, the selection is saved, and the email server is updated based on your preference.
This happens because the notfSMTPUseTLS LDAP attribute is updated differently in Identity Applications and Identity Console. When you make the change in Identity Console, the attribute is updated directly. Whereas, when you change the value in of Identity Manager’s Email Based Approval page, it updates the com.netiq.rbpm.smtp.tls property in the ism-configuration.properties file. But, the value you select in Identity Console is still applied, even if it does not appear on the Email Based Approval page in Identity Manager. [Issue: OCTCR56A585739]
Workaround: To ensure consistent behavior, you can modify the value in the option on Identity Manager’s Email Based Approval page based on the value you select in Identity Console.
10.8 On Linux, iManager Displays a Blank Page After Upgrade
Issue: After upgrading Identity Manager to 4.9, iManager no longer works if installed with other components. When you try to launch a previously installed version, iManager displays a blank page.
Workaround: Install and use Identity Console in place of iManager. However, if you want to continue using iManager after upgrading Identity Manager to version 4.9, ensure that:
-
iManager is installed on a standalone server.
-
The server has a supported version of Java. For example, iManager 3.2.6.0200 on Java JDK 1.0.8 Update 342 in Identity Manager 4.8.6
Perform the following steps to reuse the old Java files:
-
Create a new directory using the following command:
mkdir -p /opt/novell/iManager/java_iman
-
Copy the existing Java files of iManager to the new directory:
cp -r /opt/netiq/common/jre/ /opt/novell/iManager/java_iman
-
To change the ownership to the new directory, run the following command:
chown -R novlwww:novlwww /opt/novell/iManager/java_iman
-
Navigate to /etc/opt/novell/tomcat9/ and update the JAVA_HOME and JRE_HOME with the new Java path in the tomcat9.conf file.
-
Restart Tomcat using the following comment:
rcnovell-tomcat9 restart
-
10.9 Warning: Illegal Reflective Access Operation Has Occurred
Issue: When configuring Identity Applications, you might encounter the following message:
Warning: An illegal reflective access operation has occurred
This occurs because the current version of Identity Applications uses Java 11. [Issue: OCTCR56A583685]
Workaround: The warning does not affect any functionality. You can ignore it.
10.10 Tomcat Does Not Start on RHEL 8.x and 9.x After Upgrading Identity Manager to 4.9
Issue: When upgrading Identity Manager to version 4.9 on a server running RHEL 8.x or RHEL 9.x (where x is the version supported in 4.9), OSP fails to start due to a database connection issue. It typically happens when the random key generation process takes longer than expected while the OSP is getting deployed. As a result, Tomcat services also fail to start. [Issue: OCTCR56A584564]
Workaround: Modify the following lines in the java.security file at the /opt/netiq/common/jre/conf/security location and restart Tomcat:
NOTE:Before applying the workaround, refer to the RHEL documentation for more information about random number generators.
-
Replace securerandom.source=file:/dev/random
with
securerandom.source=file:/dev/./urandom
-
Replace securerandom.strongAlgorithms=NativePRNGBlocking:SUN
with
securerandom.strongAlgorithms=SHA1PRNG:SUN
10.11 Organization Chart Buttons for a Level 2 or Higher Relationship Hierarchy Is Missing
Issue: For a level 2 or higher relationship, the organization chart does not show the options to choose a relationship for viewing, navigate to the next level in the relationship hierarchy, send emails, and view more information about that entity. This issue is seen when the hierarchical depth in the is set to a level 2 (or higher). [Issue: OCTCR56A585426]
Workaround: To view the organization chart buttons for the level 2 (or higher) relationship, search for the level 2 user/entity in the organization chart.
10.12 Remote Loader Reports Invalid Driver Object Password After Upgrade
Issue: After upgrading Remote Loader to version 4.9 on a Windows platform, it is unable to connect to the Active Directory driver using the basic authentication password. [Issue: OCTCR56A584022]
Workaround: After upgrading Identity Manager to 4.9, perform the following steps:
-
Stop the Remote Loader instance on the Remote Loader server.
-
Reset the driver object password and the Remote Loader password.
-
Start the Remote Loader instance for the Active Directory driver.
10.13 Observing Error: StatusLogger Reconfiguration Failed in Catalina Log File
Issue: After installing Identity Manager 4.9 on a Windows platform, you might encounter the following error message in catalina.out logs:
ERROR StatusLogger Reconfiguration failed: No configuration found for '<xxxxxxxx>' at 'null' in 'null'
[Issue: OCTCR56A584800]
Workaround: The error does not affect any functionality. You can ignore it.
10.14 Form Builder Issues
You might encounter the following issues when you are working with JSON forms in Form Builder.
Field Validation Messages Do Not Convey the Message Clearly
Issue: Form field validation messages notify users when they enter an invalid or unacceptable value into a field. These messages typically consist of a key-value pair, with the value intended for user display. However, in this release, the form fields are displaying keys rather than the corresponding values. For example, entering an invalid email address presents invalid_email instead of Email must be a valid email.
[Issue: OCTCR56A598009]
Workaround: To add the messages for English language:
-
Launch Form Builder.
-
Click the
icon. -
Click to expand.
-
Add a trailing comma and the key-value pairs for the messages to the last line.
For example,
{ "Submit": "", "error": "Please fix the following errors before submitting.", "invalid_date": "{{field}} is not a valid date.", "invalid_email": "{{field}} must be a valid email.", "invalid_regex": "{{field}} does not match the pattern {{regex}}.", "mask": "{{field}} does not match the mask.", "max": "{{field}} cannot be greater than {{max}}.", "maxLength": "{{field}} must be shorter than {{length}} characters.", "min": "{{field}} cannot be less than {{min}}.", "minLength": "{{field}} must be longer than {{length}} characters.", "next": "Next", "pattern": "{{field}} does not match the pattern {{pattern}}", "previous": "Previous", "required": "{{field}} is required" } -
Click .
Form Field Displays Non Array Validation Error After Upgrading Designer to Version 4.9
Issue: If a single-valued form field contains multiple values, the Form Builder will now display a non-array validation error. This validation check has been added in the latest version of Form Builder. Therefore, when you upgrade Designer to version 4.9, this issue will occur in exiting forms. [Issue: OCTCR56A586045]
Workaround: To fix the error, perform one of the following options:
-
Open the form in Form Builder and select the check box in the affected form field. This will add an button to the field, allowing users to enter more values.
-
Modify the Custom Default Value function in the affected field to display only the first value returned in an array, even if the array has a single value.
Form Builder Hangs While Scrolling
Issue: The form builder occasionally freezes while scrolling through the JSON forms in and views. This issue is observed in two scenarios:
-
While working with a JSON form that contains many functions and methods.
-
When your screen resolution differs from the system recommended value.
[Issue: OCTCR56A602415]
Workaround: There is no workaround is available. You can relaunch Form Builder.
Button Action Is Not Working
Issue: After upgrading to Designer 4.9, the Button component in JSON forms is not working for approve and request actions. [Issue: OCTCR56A604329]
Workaround: Perform the following steps:
-
Go to the Button component’s tab.
-
Copy the logic specified in the or fields.
-
Change the to custom.
-
Specify the logic copied from Step 2.
-
Click .
Tree Component Issues
You might encounter the following issues with the Tree component in Form Builder:
-
The fields display a nonarray validation error in the form . This error occurs when the Tree component is set to display a default value. You will not be able to submit the form until you resolve the validation error. [Issue: OCTCR56A585664]
To resolve the error, change the default value with ID of that field in the view.
-
The expand functionality of a Tree component is not working as expected. The form does not allow you to expand or select a subcontainer.
-
When you select a container or sub-container, the field displays the dn value instead of name.
The following is a sample data from the Tree component:
{ "dn": "unique id", "name": "container data", "data": "any meta-data attached with the container", "subContainers": [ { "dn": "id1", "name": "container data1", "icon": "glyphicon glyphicon-cloud" }, { "dn": "id2", "name": "container data2", "data": "any meta-data attached with the container", "subContainers": [ { "dn": "id3", "name": "container data3", "icon": "glyphicon glyphicon-cloud" } ] } ] }When you select the option in the , the field displays the unique id instead of the container data. [Issue: OCTCR56A603396]